CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.04)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An unspecified vulnerability in the rsh tool in Sun Grid Engine 5.3 before 20060327 and N1 Grid Engine 6.0 before 20060327 allows local users to gain root privileges.
SQL injection vulnerability in general/sendpassword.php in PHPCollab 2.4 and 2.5.rc3, and NetOffice 2.5.3-pl1 and 2.6.0b2. Remote attackers can execute arbitrary SQL commands via the loginForm parameter in the "forgotten password" option.
vCounter 1.0 contains an SQL injection vulnerability in vCounter.php. Remote attackers can execute arbitrary SQL commands by manipulating the _SERVER[REQUEST_URI] variable in the URI.
In OneOrZero 1.6.3.0, the index.php file contains an SQL injection vulnerability in the id parameter, likely in the kans action. This allows a remote attacker to execute arbitrary SQL commands.
SQL injection vulnerability in index.php of Tilde CMS 3.0 allows remote attackers to execute arbitrary SQL commands via the id parameter.
In the Fast Lexical Analyzer Generator (flex) before version 2.5.33, the flex.skl file does not allocate enough memory for grammars containing REJECT statements or trailing context rules. This causes flex to generate code with a buffer overflow, potentially allowing attackers to execute arbitrary code.
An Eval Injection vulnerability in Horde Application Framework versions 3.0 before 3.0.10 and 3.1 before 3.1.1 allows remote attackers to execute arbitrary code via the help viewer.
Multiple SQL injection vulnerabilities in FusionZONE CouponZONE local.cfm in version 4.2 and earlier allow remote attackers to execute arbitrary SQL commands via the companyid, scat, and coid parameters.
The Genius VideoCAM NB driver does not drop privileges when saving files, allowing local users to gain privileges by opening arbitrary files via the 'Save As' dialog.
PHP Live Helper 1.8 contains multiple remote file inclusion (RFI) vulnerabilities in initiate.php, waiting.php, welcome.php, admin/index.php, javascript.php, checkchat.php, and blank.php. These flaws allow an attacker to remotely execute arbitrary PHP code via the abs_path parameter.
Directory traversal vulnerability in PHP Live Helper 1.8 allows remote authenticated users to include and execute arbitrary local files via the language cookie. An attacker can upload PHP code in a gl_session cookie to users.php, which is stored in error.log and then included by initiate.php.
Multiple SQL injection vulnerabilities in Pixel Motion Blog allow remote attackers to execute arbitrary SQL commands via the 'date' parameter in index.php or bypass authentication via the 'password' parameter in admin/index.php.
A buffer overflow vulnerability in client/server Doom (csDoom) 0.7 and earlier allows remote attackers to cause a denial of service via a long nickname or teamname to the SV_SetupUserInfo function, or execute arbitrary code via a long string sent when joining a match or a long chat message to the SV_BroadcastPrintf function.
A format string vulnerability in the PrintString function in c_console.cpp in client/server Doom (csDoom) 0.7 and earlier allows remote attackers to cause a denial of service and possibly execute arbitrary commands via format string specifiers in strings passed to the console.
A stack-based buffer overflow in the NetBackup Catalog daemon (bpdbm) in Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinessServer 4.5FP/4.5MP allows attackers to execute arbitrary code via unknown vectors.
A stack-based buffer overflow in the volume manager daemon (vmd) of Veritas NetBackup Enterprise Server 5.0 through 6.0 and DataCenter and BusinessServer 4.5FP/4.5MP allows attackers to execute arbitrary code via unknown vectors.
Buffer overflow vulnerability in the NetBackup Sharepoint Services server daemon (bpspsserver) in NetBackup 6.0 for Windows. A remote attacker can send crafted "Request Service" packets to the vnetd service (TCP port 13724), leading to arbitrary code execution.
SQL injection vulnerability in mb.cgi in Cholod MySQL Based Message Board allows remote attackers to execute arbitrary SQL commands via unspecified vectors in a showmessage action, possibly the username parameter. The provenance of this information is unknown; details are obtained from third party information.
The rdiff and preview scripts in TWiki 4.0 and 4.0.1 ignore access control settings, allowing remote attackers to read restricted areas and access restricted content in TWiki topics.
An unspecified vulnerability in the swagentd service on HP-UX B.11.00, B.11.04, and B.11.11 allows remote attackers to cause a denial of service (application crash) via unspecified vectors.